p PatchFirst

CVE-2026-26956

CVE-2026-26956 · vm2: WASM Sandbox Escape (Node 25 only)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox escape with arbitrary code execution. Attacker code inside VM.run() obtains host process object and runs host commands with zero host cooperation. This issue has been patched in version 3.10.5.

CVSS 9.8 · Critical · EPSS 1.1% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • vm2

    Versions
    • = 3.10.4: Affected

    No fix published

  • vm2 npm

    Affected ranges
    • SEMVER: < 3.10.5

    Update to 3.10.5

Original sources

Check your server →